pi-webdav-backup 1.0.0

package/extensions/webdav-backup/test-auth-migrate.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+/**
+ * test-auth-migrate.mjs — auth.json 明文密钥迁移测试
+ *
+ * 关键不变量：
+ *   - 空 key（pi 用它表示“未配置”）绝不能改成引用
+ *   - 已是引用的不重复迁移
+ *   - 迁移后文件里不再有明文，且引用可被解析出原值
+ *   - 写环境变量失败时不动文件（避免丢密钥）
+ */
+
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+let pass = 0;
+let fail = 0;
+const lines = [];
+const check = (n, c, d = "") => {
+  if (c) {
+    pass++;
+    lines.push(`  ✅ ${n}`);
+  } else {
+    fail++;
+    lines.push(`  ❌ ${n}${d ? ` — ${d}` : ""}`);
+  }
+};
+
+const agentDir = mkdtempSync(join(tmpdir(), "pi-auth-mig-"));
+process.env.PI_CODING_AGENT_DIR = agentDir;
+
+const A = await import("./auth-migrate.mjs");
+const S = await import("./secrets.mjs");
+
+const authPath = join(agentDir, "auth.json");
+const write = (obj) => writeFileSync(authPath, JSON.stringify(obj, null, 2));
+
+console.log("pi WebDAV 备份 — auth.json 迁移测试\n");
+
+// ── 1. 环境变量命名
+check("provider 名转为合法环境变量名", A.envVarNameFor("deepseek") === "PI_PI_KEY_DEEPSEEK");
+check("含连字符的 provider", A.envVarNameFor("azure-openai-responses") === "PI_PI_KEY_AZURE_OPENAI_RESPONSES");
+check("含点的 provider", A.envVarNameFor("foo.bar") === "PI_PI_KEY_FOO_BAR");
+check("空名兜底", A.envVarNameFor("") === "PI_PI_KEY_");
+
+// ── 2. 扫描
+write({
+  deepseek: { type: "api_key", key: "sk-" + "a".repeat(32) },
+  "azure-openai-responses": { type: "api_key", key: "" },
+  migrated: { type: "api_key", key: "$ALREADY_SET" },
+  cmdbased: { type: "api_key", key: "!pass show foo" },
+  dpapied: { type: "api_key", key: "dpapi:some-name" },
+});
+
+const scan = A.scanAuthSecrets();
+check("扫描成功", scan.ok === true, JSON.stringify(scan));
+const byProvider = Object.fromEntries(scan.items.map((i) => [i.provider, i]));
+check("识别 deepseek 为明文", byProvider.deepseek?.kind === "plaintext");
+check("识别空 key 为 empty", byProvider["azure-openai-responses"]?.kind === "empty");
+check("识别 $VAR 为引用", byProvider.migrated?.kind === "reference");
+check("识别 !命令 为引用", byProvider.cmdbased?.kind === "reference");
+check("识别 dpapi: 为引用", byProvider.dpapied?.kind === "reference");
+check("明文项提供建议环境变量名", byProvider.deepseek?.suggestedEnv === "PI_PI_KEY_DEEPSEEK");
+check("明文项提供建议 dpapi 名", byProvider.deepseek?.suggestedDpapi === "dpapi:auth-deepseek");
+check("扫描结果不含密钥明文", !JSON.stringify(scan).includes("sk-aaaa"));
+
+// ── 3. dry-run 不改文件
+const before = readFileSync(authPath, "utf8");
+const dry = await A.migrateAuthJson({ method: "env", log: () => {}, dryRun: true });
+check("dry-run 报告待迁移项", dry.ok && dry.wouldMigrate?.length === 1, JSON.stringify(dry));
+check("dry-run 指定目标为 $ENV", dry.wouldMigrate?.[0]?.target === "$PI_PI_KEY_DEEPSEEK");
+check("dry-run 未修改文件", readFileSync(authPath, "utf8") === before);
+
+// ── 4. 真实迁移（env）
+if (S.dpapiAvailable()) {
+  const real = await A.migrateAuthJson({ method: "env", log: () => {} });
+  check("迁移成功", real.ok === true, JSON.stringify(real));
+  check("迁移了 1 项", real.migrated === 1, `migrated=${real.migrated}`);
+  check("迁移前备份 auth.json", !!real.backup && existsSync(real.backup));
+  check("待重启环境变量已列出", real.envVarsNeedRestart?.includes("PI_PI_KEY_DEEPSEEK"));
+
+  const afterObj = JSON.parse(readFileSync(authPath, "utf8"));
+  check("deepseek.key 已变为 $ENV 引用", afterObj.deepseek.key === "$PI_PI_KEY_DEEPSEEK", afterObj.deepseek.key);
+  check(
+    "auth.json 不再含明文密钥",
+    !readFileSync(authPath, "utf8").includes("sk-aaaa"),
+    "明文仍存在",
+  );
+  check("空 key 保持为空（未被破坏）", afterObj["azure-openai-responses"].key === "", JSON.stringify(afterObj["azure-openai-responses"]));
+  check("已有引用未被改写", afterObj.migrated.key === "$ALREADY_SET");
+  check("!命令引用未被改写", afterObj.cmdbased.key === "!pass show foo");
+  check("dpapi 引用未被改写", afterObj.dpapied.key === "dpapi:some-name");
+  check("type 字段保持", afterObj.deepseek.type === "api_key");
+
+  // 迁移后的引用必须能解析出原值
+  const resolved = S.resolveSecret(afterObj.deepseek.key);
+  check("迁移后的引用可解析出原密钥", resolved.value === "sk-" + "a".repeat(32), JSON.stringify({ source: resolved.source, len: resolved.value?.length }));
+
+  // 备份文件应保留原明文（用于回滚）
+  check("备份文件保留了可回滚的原文", readFileSync(real.backup, "utf8").includes("sk-aaaa"));
+
+  // 重复迁移无副作用
+  const again = await A.migrateAuthJson({ method: "env", log: () => {} });
+  check("重复迁移为 0 项", again.ok === true && again.message !== undefined, JSON.stringify(again));
+
+  // ── 5. dpapi 方式
+  write({
+    provider1: { type: "api_key", key: "secret-key-one-1234567890" },
+    provider2: { type: "api_key", key: "secret-key-two-0987654321" },
+  });
+  const dp = await A.migrateAuthJson({ method: "dpapi", log: () => {} });
+  check("dpapi 迁移成功", dp.ok === true, JSON.stringify(dp));
+  check("dpapi 迁移 2 项", dp.migrated === 2, `migrated=${dp.migrated}`);
+  const dpObj = JSON.parse(readFileSync(authPath, "utf8"));
+  check("provider1 → dpapi 引用", dpObj.provider1.key === "dpapi:auth-provider1", dpObj.provider1.key);
+  check("dpapi 迁移后无明文", !readFileSync(authPath, "utf8").includes("secret-key-one"));
+  check("dpapi 引用可解出原值", S.resolveSecret(dpObj.provider1.key).value === "secret-key-one-1234567890");
+
+  // ── 6. perProvider 覆盖：部分保留
+  write({
+    keepme: { type: "api_key", key: "keep-this-plaintext-key-1234" },
+    moveme: { type: "api_key", key: "move-this-plaintext-key-5678" },
+  });
+  const mixed = await A.migrateAuthJson({
+    method: "dpapi",
+    perProvider: { keepme: "keep", moveme: "env" },
+    log: () => {},
+  });
+  check("混合迁移成功", mixed.ok === false || mixed.migrated === 1, JSON.stringify(mixed));
+  const mixedObj = JSON.parse(readFileSync(authPath, "utf8"));
+  check("keepme 保持明文（用户选择）", mixedObj.keepme.key === "keep-this-plaintext-key-1234");
+  check("moveme 迁移为引用", mixedObj.moveme.key.startsWith("$"), mixedObj.moveme.key);
+  check("剩余明文被报告", mixed.remainingPlaintext?.includes("keepme"), JSON.stringify(mixed.remainingPlaintext));
+} else {
+  lines.push("  ⏭  跳过真实迁移（非 Windows）");
+}
+
+// ── 7. 空 auth.json / 无明文
+write({});
+const none = await A.migrateAuthJson({ method: "env", log: () => {} });
+check("无条目时报告无需迁移", none.ok === true && none.migrated === 0, JSON.stringify(none));
+
+write({ p: { type: "api_key", key: "" } });
+const onlyEmpty = await A.migrateAuthJson({ method: "env", log: () => {} });
+check("仅空 key 时不动文件", onlyEmpty.ok === true && onlyEmpty.migrated === 0, JSON.stringify(onlyEmpty));
+check("空 key 仍为空", JSON.parse(readFileSync(authPath, "utf8")).p.key === "");
+
+// ── 8. 损坏的 auth.json
+writeFileSync(authPath, "{ broken json");
+const broken = A.scanAuthSecrets();
+check("损坏 JSON 被识别", broken.ok === false && /不是合法 JSON/.test(broken.error), JSON.stringify(broken));
+const brokenMig = await A.migrateAuthJson({ method: "env", log: () => {} });
+check("损坏 JSON 时迁移被拒绝", brokenMig.ok === false);
+
+// ── 9. 不存在的 auth.json
+rmSync(authPath, { force: true });
+const missing = A.scanAuthSecrets();
+check("缺失 auth.json 被识别", missing.ok === false && /不存在/.test(missing.error), JSON.stringify(missing));
+
+// ── 10. 脱敏保留引用（回归：引用被抹掉会丢失“密钥在哪”的信息）
+const { redactSensitive } = await import("./backup.mjs");
+const refAuth = JSON.stringify({
+  deepseek: { type: "api_key", key: "$PI_PI_KEY_DEEPSEEK" },
+  other: { type: "api_key", key: "sk-realm-plaintext-secret" },
+  empty: { type: "api_key", key: "" },
+  cmd: { type: "api_key", key: "!pass show x" },
+  dp: { type: "api_key", key: "dpapi:auth-x" },
+});
+const red = redactSensitive("auth.json", Buffer.from(refAuth), { aggressive: true }).toString("utf8");
+const redObj = JSON.parse(red);
+check("脱敏保留 $ENV 引用", redObj.deepseek.key === "$PI_PI_KEY_DEEPSEEK", redObj.deepseek.key);
+check("脱敏保留 !命令 引用", redObj.cmd.key === "!pass show x");
+check("脱敏保留 dpapi 引用", redObj.dp.key === "dpapi:auth-x");
+check("脱敏保留空 key", redObj.empty.key === "");
+check("脱敏替换真明文", redObj.other.key === "__REDACTED__", redObj.other.key);
+check("脱敏后不含真明文", !red.includes("sk-realm-plaintext-secret"));
+
+// 清理
+try {
+  rmSync(agentDir, { recursive: true, force: true });
+} catch {
+  /* ignore */
+}
+
+console.log(lines.join("\n"));
+console.log(`\n结果：${pass} 通过，${fail} 失败`);
+process.exit(fail === 0 ? 0 : 1);

package/extensions/webdav-backup/test-cli.mjs

@@ -0,0 +1,331 @@
+#!/usr/bin/env node
+/**
+ * test-cli.mjs — CLI 子进程集成测试
+ *
+ * 与 test.mjs 互补：这里通过 spawn 真实调用 cli.mjs，
+ * 验证扩展实际使用的代码路径（含退出备份那套参数）。
+ *
+ * 用法：node test-cli.mjs
+ */
+
+import { spawn } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
+
+import { startDavServer } from "./dav-mock.mjs";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const CLI = join(here, "cli.mjs");
+
+let pass = 0;
+let fail = 0;
+const lines = [];
+const check = (name, cond, detail = "") => {
+  if (cond) {
+    pass++;
+    lines.push(`  ✅ ${name}`);
+  } else {
+    fail++;
+    lines.push(`  ❌ ${name}${detail ? ` — ${detail}` : ""}`);
+  }
+};
+
+function runCli(args, env) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [CLI, ...args], {
+      env: { ...process.env, ...env },
+      windowsHide: true,
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => (stdout += d.toString("utf8")));
+    child.stderr.on("data", (d) => (stderr += d.toString("utf8")));
+    child.on("close", (code) => resolve({ code, stdout, stderr }));
+  });
+}
+
+const lastJson = (out) => {
+  const line = out.trim().split("\n").filter((l) => l.trim().startsWith("{")).pop();
+  try {
+    return JSON.parse(line ?? "{}");
+  } catch {
+    return {};
+  }
+};
+
+async function main() {
+  console.log("pi WebDAV 备份 — CLI 集成测试\n");
+
+  const dav = await startDavServer();
+  const baseUrl = `http://127.0.0.1:${dav.port}/dav`;
+  dav.dirs.add("/dav");
+
+  const agentDir = mkdtempSync(join(tmpdir(), "pi-cli-test-"));
+  mkdirSync(join(agentDir, "extensions", "sub"), { recursive: true });
+  writeFileSync(join(agentDir, "extensions", "a.ts"), "export default () => {};\n");
+  writeFileSync(join(agentDir, "extensions", "sub", "b.md"), "# hello\n");
+  writeFileSync(join(agentDir, "settings.json"), '{"theme":"dark"}\n');
+  writeFileSync(join(agentDir, "auth.json"), JSON.stringify({ p: { key: "sk-LEAK-CANARY" } }));
+  writeFileSync(
+    join(agentDir, "webdav-backup.json"),
+    JSON.stringify(
+      {
+        enabled: true,
+        remote: { url: baseUrl, username: "user", password: "pass", remoteDir: "bk", remoteName: "pi" },
+        scope: ["."],
+        includeSessions: false,
+        encrypt: false,
+        keepVersions: 3,
+        backupOnExit: true,
+        backupOnExitMinIntervalMinutes: 0,
+      },
+      null,
+      2,
+    ),
+  );
+  const env = { PI_CODING_AGENT_DIR: agentDir };
+  // 父进程也要指向同一个 agentDir，否则 setDpapiSecret 会写到真实 ~/.pi/agent
+  process.env.PI_CODING_AGENT_DIR = agentDir;
+
+  // 1. check
+  const chk = await runCli(["check", "--json"], env);
+  const chkJson = lastJson(chk.stdout);
+  check("check 退出码 0", chk.code === 0, `code=${chk.code} ${chk.stderr}`);
+  check("check 认证通过", chkJson.ok === true, JSON.stringify(chkJson));
+
+  // 2. 错误密码
+  writeFileSync(
+    join(agentDir, "webdav-backup.json"),
+    JSON.stringify(
+      { remote: { url: baseUrl, username: "user", password: "nope", remoteDir: "bk", remoteName: "pi" } },
+      null,
+      2,
+    ),
+  );
+  const bad = await runCli(["check", "--json"], env);
+  const badJson = lastJson(bad.stdout);
+  check("错误密码退出码非 0", bad.code !== 0);
+  check("错误密码提示 401", /401|认证/.test(String(badJson.error)), JSON.stringify(badJson));
+
+  // 3. 正常配置下的备份（模拟扩展退出时的调用）
+  writeFileSync(
+    join(agentDir, "webdav-backup.json"),
+    JSON.stringify(
+      {
+        enabled: true,
+        remote: { url: baseUrl, username: "user", password: "pass", remoteDir: "bk", remoteName: "pi" },
+        scope: ["."],
+        includeSessions: false,
+        encrypt: false,
+        keepVersions: 3,
+        backupOnExit: true,
+        backupOnExitMinIntervalMinutes: 0,
+      },
+      null,
+      2,
+    ),
+  );
+  const bk = await runCli(["backup", "--reason", "exit", "--json"], env);
+  const bkJson = lastJson(bk.stdout);
+  check("退出备份退出码 0", bk.code === 0, `code=${bk.code} ${bk.stderr}`);
+  check("退出备份成功", bkJson.ok === true, JSON.stringify(bkJson));
+  check("退出备份有远端路径", typeof bkJson.remotePath === "string", JSON.stringify(bkJson));
+  check("退出备份已脱敏 auth.json", Number(bkJson.redacted) > 0, `redacted=${bkJson.redacted}`);
+
+  // 4. 归档内容确实脱敏 + 排除生效
+  const archiveName = String(bkJson.archive);
+  const blob = dav.store.get(`/dav/bk/${archiveName}`);
+  check("远端存在该归档", !!blob);
+  if (blob) {
+    const text = gunzipSync(blob).toString("latin1");
+    check("归档不含明文密钥", !text.includes("sk-LEAK-CANARY"), "密钥泄漏！");
+    check("归档含 extensions/a.ts", text.includes("extensions/a.ts"));
+    check("归档含嵌套文件", text.includes("extensions/sub/b.md"));
+    check("归档写入备份者自身配置", text.includes("webdav-backup.json"));
+    check("归档中配置密码被脱敏", !text.includes("\"password\": \"pass\""), "配置密码泄漏！");
+  }
+
+  // 5. status
+  const st = await runCli(["status", "--json"], env);
+  const stJson = lastJson(st.stdout);
+  check("status 返回 lastBackupAt", typeof stJson.state?.lastBackupAt === "string", JSON.stringify(stJson));
+
+  // 6. list
+  const ls = await runCli(["list", "--json"], env);
+  const lsJson = lastJson(ls.stdout);
+  check("list 至少返回 1 个文件", Array.isArray(lsJson.files) && lsJson.files.length >= 1);
+
+  // 7. prune 只保留 1 个
+  await new Promise((r) => setTimeout(r, 1100));
+  await runCli(["backup", "--reason", "manual", "--json"], env);
+  const pr = await runCli(["prune", "--keep", "1", "--json"], env);
+  const prJson = lastJson(pr.stdout);
+  check("prune 执行成功", prJson.ok === true, JSON.stringify(prJson));
+  check("prune 保留了 1 个", prJson.kept === 1, `kept=${prJson.kept}`);
+
+  // 8. dry-run 不写远端
+  const beforePut = dav.stats().putCount;
+  const dry = await runCli(["backup", "--dry-run", "--json"], env);
+  const dryJson = lastJson(dry.stdout);
+  check("dry-run 成功", dryJson.ok === true && dryJson.dryRun === true, JSON.stringify(dryJson));
+  check("dry-run 未上传", dav.stats().putCount === beforePut);
+
+  // 9. 缺配置时的错误处理
+  const emptyDir = mkdtempSync(join(tmpdir(), "pi-cli-empty-"));
+  const miss = await runCli(["backup", "--json"], { PI_CODING_AGENT_DIR: emptyDir });
+  const missJson = lastJson(miss.stdout);
+  check("缺配置时退出码非 0", miss.code !== 0);
+  check("缺配置时给出明确错误", /配置文件不存在/.test(String(missJson.error)), JSON.stringify(missJson));
+
+  // 10. 非法 URL 配置
+  writeFileSync(
+    join(emptyDir, "webdav-backup.json"),
+    JSON.stringify({ remote: { url: "ftp://x/y", username: "u", password: "p" } }, null, 2),
+  );
+  const badUrl = await runCli(["backup", "--json"], { PI_CODING_AGENT_DIR: emptyDir });
+  const badUrlJson = lastJson(badUrl.stdout);
+  check("非法协议被拒绝", badUrl.code !== 0 && /http/.test(String(badUrlJson.error)), JSON.stringify(badUrlJson));
+
+  // 11. 日志文件确实写入
+  const logPath = join(agentDir, "webdav-backup.log");
+  check("日志文件已生成", existsSync(logPath));
+  if (existsSync(logPath)) {
+    const log = readFileSync(logPath, "utf8");
+    check("日志记录了开始备份", /开始备份/.test(log));
+    check("日志记录了完成", /完成|上传中/.test(log));
+  }
+
+  // 12. 加密模式经 CLI 全流程，并用库解密回读
+  writeFileSync(
+    join(agentDir, "webdav-backup.json"),
+    JSON.stringify(
+      {
+        remote: { url: baseUrl, username: "user", password: "pass", remoteDir: "bk", remoteName: "pi-enc" },
+        encrypt: true,
+        encryptKey: "correct-horse-battery-staple",
+      },
+      null,
+      2,
+    ),
+  );
+  const encRun = await runCli(["backup", "--reason", "manual", "--json"], env);
+  const encJson = lastJson(encRun.stdout);
+  check("加密备份成功", encJson.ok === true, JSON.stringify(encJson));
+  check("加密归档后缀 .pibak", String(encJson.archive).endsWith(".pibak"), String(encJson.archive));
+
+  const encBlob = dav.store.get(`/dav/bk/${encJson.archive}`);
+  if (encBlob) {
+    const { decryptFile } = await import("./crypto.mjs");
+    const encTmp = join(agentDir, "rt.pibak");
+    const outTmp = join(agentDir, "rt.tar.gz");
+    writeFileSync(encTmp, encBlob);
+    await decryptFile(encTmp, outTmp, "correct-horse-battery-staple");
+    const plain = gunzipSync(readFileSync(outTmp)).toString("latin1");
+    check("CLI 加密归档可解密回读", plain.includes("extensions/a.ts"));
+    check("解密后仍无明文密钥", !plain.includes("sk-LEAK-CANARY"));
+
+    let wrongOk = false;
+    try {
+      await decryptFile(encTmp, join(agentDir, "rt2.tar.gz"), "wrong-key-wrong-key");
+      wrongOk = true;
+    } catch {
+      wrongOk = false;
+    }
+    check("错误密钥解密被拒绝", wrongOk === false);
+  } else {
+    check("CLI 加密归档存在", false, "未找到加密归档");
+  }
+
+  // 13. DPAPI 引用端到端（验证子进程可解密 → 实际生产路径）
+  const { setDpapiSecret, dpapiAvailable, deleteDpapiSecret } = await import("./secrets.mjs");
+  if (dpapiAvailable()) {
+    setDpapiSecret("cli-e2e-password", "pass");
+    writeFileSync(
+      join(agentDir, "webdav-backup.json"),
+      JSON.stringify(
+        {
+          remote: {
+            url: baseUrl,
+            username: "user",
+            password: "dpapi:cli-e2e-password",
+            remoteDir: "bk",
+            remoteName: "pi-dpapi",
+          },
+          keepVersions: 2,
+        },
+        null,
+        2,
+      ),
+    );
+    check("配置文件不含明文密码", !readFileSync(join(agentDir, "webdav-backup.json"), "utf8").includes('"pass"'));
+
+    const dpChk = await runCli(["check", "--json"], env);
+    check("DPAPI 密码可通过子进程认证", lastJson(dpChk.stdout).ok === true, dpChk.stdout.trim());
+
+    const dpBk = await runCli(["backup", "--reason", "exit", "--json"], env);
+    check("DPAPI 密码可完成退出备份", lastJson(dpBk.stdout).ok === true, lastJson(dpBk.stdout).error ?? "");
+
+    // 凭证错误时应报认证失败（而不是谜之错误）
+    setDpapiSecret("cli-e2e-password", "wrong-password");
+    const dpBad = await runCli(["check", "--json"], env);
+    const dpBadJson = lastJson(dpBad.stdout);
+    check("DPAPI 错误密码报 401", dpBad.code !== 0 && /401|认证/.test(String(dpBadJson.error)), JSON.stringify(dpBadJson));
+
+    // 引用不存在的密钥时应阻断而非静默空密码
+    writeFileSync(
+      join(agentDir, "webdav-backup.json"),
+      JSON.stringify(
+        { remote: { url: baseUrl, username: "user", password: "dpapi:no-such-entry", remoteDir: "bk" } },
+        null,
+        2,
+      ),
+    );
+    const dpMiss = await runCli(["backup", "--json"], env);
+    const dpMissJson = lastJson(dpMiss.stdout);
+    check("引用缺失密钥时失败", dpMiss.code !== 0, JSON.stringify(dpMissJson));
+    check("错误信息指明密钥名", /no-such-entry/.test(String(dpMissJson.error)), JSON.stringify(dpMissJson));
+
+    deleteDpapiSecret("cli-e2e-password");
+
+    // doctor 报告应把明文标出来
+    writeFileSync(
+      join(agentDir, "webdav-backup.json"),
+      JSON.stringify({ remote: { url: baseUrl, username: "user", password: "plaintext-pw", remoteDir: "bk" } }),
+    );
+    const doc = await runCli(["doctor", "--json"], env);
+    const docJson = lastJson(doc.stdout);
+    check("doctor 识别明文密码", docJson.password?.plaintext === true, JSON.stringify(docJson.password));
+
+    writeFileSync(
+      join(agentDir, "webdav-backup.json"),
+      JSON.stringify({ remote: { url: baseUrl, username: "user", password: "$PI_TEST_CLI_PW", remoteDir: "bk" } }),
+    );
+    const doc2 = await runCli(["doctor", "--json"], { ...env, PI_TEST_CLI_PW: "pass" });
+    const doc2Json = lastJson(doc2.stdout);
+    check("doctor 识别 env 来源", doc2Json.password?.source === "env", JSON.stringify(doc2Json.password));
+    check("doctor env 密码不算明文", doc2Json.password?.plaintext === false);
+  } else {
+    lines.push("  ⏭  跳过 DPAPI 端到端（非 Windows）");
+  }
+
+  dav.server.close();
+  try {
+    rmSync(agentDir, { recursive: true, force: true });
+    rmSync(emptyDir, { recursive: true, force: true });
+  } catch {
+    /* ignore */
+  }
+
+  console.log(lines.join("\n"));
+  console.log(`\n结果：${pass} 通过，${fail} 失败`);
+  process.exit(fail === 0 ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.log(lines.join("\n"));
+  console.error(`\n测试异常：${e?.stack ?? e}`);
+  process.exit(1);
+});